Drop --locked from the float_roundtrip check: --no-deps never reads the lockfile

Review of #202 showed `cargo metadata --no-deps --locked` exits 0 against a
stale lockfile, so the flag promised a check it does not make.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

context/test-evidence/tooling.md

@@ -687,7 +687,7 @@ cannot see this rival.
 ### `every_crate_that_can_parse_json_enables_float_roundtrip`
 
 It replaces a check over three crates listed by hand. It reads
-`cargo metadata --no-deps --locked` and fails naming every workspace package, and
+`cargo metadata --no-deps` and fails naming every workspace package, and
 every target-specific entry, whose **normal** serde_json dependency lacks
 `float_roundtrip`. The rule and why it was chosen over the alternatives are in
 `context/code/protocol.md`. It is red at `1158c23`, naming `improvise`,

tests/json_numbers.rs

@@ -38,7 +38,7 @@ fn lossy_json_dependencies(metadata: &Value) -> (Vec<String>, Vec<String>) {
 fn every_crate_that_can_parse_json_enables_float_roundtrip() {
     let out = std::process::Command::new(env!("CARGO"))
         .current_dir(env!("CARGO_MANIFEST_DIR"))
-        .args(["metadata", "--no-deps", "--locked", "--format-version", "1"])
+        .args(["metadata", "--no-deps", "--format-version", "1"])
         .output()
         .expect("cargo metadata must run");
     assert!(